CVE-2025-54261: ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Published Sep 9, 2025
·Updated
ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.
Affected Software
43 affected components
Adobe ColdFusion<=2025.3, <=2023.15, <=2021.21
Adobe ColdFusion=2021
Adobe ColdFusion=2021-update1
Adobe ColdFusion=2021-update10
Adobe ColdFusion=2021-update11
Adobe ColdFusion=2021-update12
Adobe ColdFusion=2021-update13
Adobe ColdFusion=2021-update14
Adobe ColdFusion=2021-update15
Adobe ColdFusion=2021-update16
Adobe ColdFusion=2021-update17
Adobe ColdFusion=2021-update18
Adobe ColdFusion=2021-update19
Adobe ColdFusion=2021-update2
Adobe ColdFusion=2021-update20
Adobe ColdFusion=2021-update21
Adobe ColdFusion=2021-update3
Adobe ColdFusion=2021-update4
Adobe ColdFusion=2021-update5
Adobe ColdFusion=2021-update6
Adobe ColdFusion=2021-update7
Adobe ColdFusion=2021-update8
Adobe ColdFusion=2021-update9
Adobe ColdFusion=2023
Adobe ColdFusion=2023-update1
Adobe ColdFusion=2023-update10
Adobe ColdFusion=2023-update11
Adobe ColdFusion=2023-update12
Adobe ColdFusion=2023-update13
Adobe ColdFusion=2023-update14
Adobe ColdFusion=2023-update15
Adobe ColdFusion=2023-update2
Adobe ColdFusion=2023-update3
Adobe ColdFusion=2023-update4
Adobe ColdFusion=2023-update5
Adobe ColdFusion=2023-update6
Adobe ColdFusion=2023-update7
Adobe ColdFusion=2023-update8
Adobe ColdFusion=2023-update9
Adobe ColdFusion=2025
Adobe ColdFusion=2025-update1
Adobe ColdFusion=2025-update2
Adobe ColdFusion=2025-update3
Event History
Sep 9, 2025
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-54261?
CVE-2025-54261 has a high severity rating due to its potential for arbitrary code execution.
2
How do I fix CVE-2025-54261?
To fix CVE-2025-54261, upgrade to the latest version of Adobe ColdFusion that addresses this vulnerability.
3
What versions of Adobe ColdFusion are affected by CVE-2025-54261?
Adobe ColdFusion versions 2025.3, 2023.15, and 2021.21 are affected by CVE-2025-54261.
4
What type of vulnerability is CVE-2025-54261?
CVE-2025-54261 is classified as a Path Traversal vulnerability.
5
What could an attacker achieve by exploiting CVE-2025-54261?
An attacker could achieve arbitrary code execution on the server by exploiting CVE-2025-54261.